Description
Session fixation vulnerability in Social ImpressCMS before 1.1.1 RC1 allows remote attackers to hijack web sessions by setting the PHPSESSID parameter.
References
- 32985 third-party-advisory
- http://sourceforge.net/forum/forum.php?forum_id=893767
- 50413 vdb-entry
- http://wiki.impresscms.org/index.php?title=Change_Log#2008-12-2_:_1.1.1_RC
- impresscms-phpsessid-session-hijacking(46989) vdb-entry
- 32495 vdb-entry
- 20081203 Re: [HACKATTACK Advisory 20081127]Social Impress CMS 1.1 - Session Fixation mailing-list
- 20081127 [HACKATTACK Advisory 20081127]Social Impress CMS 1.1 - Session Fixation mailing-list